PHP CVE Radar — Privacy policy

PHP CVE Radar automatically checks the webpages you visit for PHP indicators, including reported PHP versions. That processing happens in your browser. The extension does not collect, transmit, sell, or share your data. There is no account, no backend service, and no analytics or tracking of any kind.

• Pages you visit. The extension automatically inspects the webpages you visit to identify PHP indicators, including reported PHP versions relevant to its check.
• Minimal per-tab observations. It temporarily stores minimal per-tab observations in chrome.storage.session — such as whether a page appears to run PHP and which versions were observed — so results stay associated with the correct tab.
• Bundled vulnerability data. CVE identifiers, affected version ranges, severity, and reference links that ship with the extension.

The extension reads the main document's response headers, page address, selected CMS generator metadata, and selected script and stylesheet paths. It does not scan Composer files or package dependencies.

Observations are kept separate per tab. They are not combined into a browsing profile, and the extension does not build a history of the pages you visit.

All analysis happens on your device using the browser's built-in extension APIs. PHP indicators are processed locally and matched against the bundled vulnerability data inside your browser. Nothing the extension observes, and no derived result, is sent to fmontes or to any third party. There is no remote scanning service and no server-side component.

The extension requests only the permissions needed for its single purpose. Each permission is used solely as described here:

• Access to the pages you visit — to check webpages automatically for PHP indicators, including reported PHP versions. It is not used to monitor activity beyond that check or to build a browsing history.
• Session storage — to keep minimal per-tab observations in chrome.storage.session until the tab closes.

The extension does not request access to your bookmarks, downloads, clipboard, or credentials.

Because no data is transmitted, there is no server-side retention. Per-tab observations in chrome.storage.session are discarded automatically when the tab closes or the browser restarts. The extension keeps no persistent storage that would need to be deleted, and uninstalling it removes its session data.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements. In particular:

• Data is used only to provide or improve the extension's single, user-facing purpose.
• Data is not sold or transferred to third parties.
• Data is not used or transferred for purposes unrelated to the extension's single purpose.
• Data is not used or transferred to determine creditworthiness or for lending purposes.
• Data is not used for personalized advertising.

The extension minimizes risk by keeping all processing local and by requesting the narrowest permissions that support its purpose. It communicates with no backend, so there is no server, database, or API key that could expose your information. Extension updates are delivered through the Chrome Web Store.

PHP CVE Radar is a developer tool and is not directed to children. It does not knowingly collect personal information from anyone, including children under 13.

If this policy changes, the updated version will be posted at this URL with a new effective date. Material changes will be reflected here before they take effect.

Questions about this policy or the extension's data practices can be sent to fmontes at freddymontes+chrome@gmail.com.